Variante de rootkit DORKBOT cazada heuristicamente por el ELISTARA

A partir del ELISTARA 24.68 pasamos a controlar especificamente esta muestra de DORKBOT

El preanalisis de virustotal nos muestra el siguieten informe
NOMBRE FICHERO: HPKQKX.EXE.Muestra EliStartPage v24.65

51b95a4c968651f27c7bc4d984b42aa377f3842c7c33e27918faba362ce81
SHA1: 4822fb92b1b2f5b211de96255e0a3699a222073a
MD5: 747656f1939753c9d6fbe0698b8e3ca3
File size: 414.2 KB ( 424111 bytes )
File type: Win32 EXE
Detection ratio: 16 / 42
Analysis date: 2011-11-10 08:39:40 UTC ( 2 months, 1 week ago )

01Antivirus Result Update
AhnLab-V3 – 20111109
AntiVir – 20111109
Antiy-AVL – 20111109
Avast – 20111109
AVG Worm/VB.10.W 20111109
BitDefender Trojan.Generic.KDV.399396 20111110
ByteHero Virus.Win32.Heur.p 20111104
CAT-QuickHeal – 20111110
ClamAV – 20111110
Commtouch – 20111110
DrWeb Trojan.PWS.Dybalom 20111110
Emsisoft Virus.Win32.VB.10!IK 20111110
eSafe – 20111109
eTrust-Vet – 20111109
F-Prot – 20111109
F-Secure Trojan.Generic.KDV.399396 20111110
Fortinet – 20111110
GData Trojan.Generic.KDV.399396 20111110
Ikarus Virus.Win32.VB.10 20111110
Jiangmin – 20111109
K7AntiVirus – 20111109
Kaspersky Worm.Win32.Ngrbot.hbf 20111110
McAfee Artemis!747656F19397 20111110
McAfee-GW-Edition Artemis!747656F19397 20111109
Microsoft VirTool:Win32/VBInject.RT 20111110
NOD32 a variant of Win32/Delf.ODP 20111110
Norman – 20111108
nProtect – 20111110
Panda Suspicious file 20111109
PCTools – 20111110
Prevx – 20111110
Rising – 20111108
Sophos – 20111110
SUPERAntiSpyware Trojan.Agent/Gen-Faker 20111110
Symantec – 20111110
TheHacker – 20111109
TrendMicro – 20111110
TrendMicro-HouseCall – 20111110
VBA32 – 20111109
VIPRE Trojan.Win32.Generic!BT 20111110
ViRobot – 20111110
VirusBuster – 20111109
Dicha version del ELISTARA 24.68 que lo detecta y elimina, estará disponible en nuestra web a partir delas 19 h CEST de hoy

saludos

ms, 18-1-2012